EU AI Act training: what the Act means for your organisation and your role

Opens by asking you to list the AI tools you used at work this week and who decided you could use them. Then presents a case from early 2024, when an employee at the Hong Kong office of Arup, a global engineering firm, made fifteen transfers after a video call in which, according to the police, everyone else was a deepfake. Explains four kinds of risk the EU regulates, such as deception and unfair decisions, and how the EU AI Act sets rules in proportion to risk, in levels, applying in stages as amended in July 2026. Introduces JKL Recruit SAS, a recruitment-software company in Paris with developers in Mumbai and client support in Manila. Ends with how the ten modules, practice questions and final exam work, and a recap.

What you will be able to do

• Explain why the EU regulates AI, using a real deepfake case
• Describe the Act's risk-based levels and its staged application
• List the AI tools you use at work as a starting point

Why it matters

Knowing how convincing AI deception has become helps you question unusual requests before money or data leaves the business.

Practice: Practice: Why the EU AI Act · 3 questions

Starts with two questions asked in the same week at JKL Recruit: whether an old filter that rejects CVs without certain keywords is AI under the Act, and whether the Act applies when a client in Dubai hires staff for its office in Amsterdam. Explains that an AI system is machine-based and infers how to generate its outputs, while software that only runs rules written by people is not. Covers providers placing AI on the EU market wherever they are, deployers in the EU, others whose AI output is used in the EU, what is left out, and why this matters to learners in Dubai, India and the Philippines. Shows an analyst at a bank in Frankfurt using her own chatbot account, then how to build an AI inventory. Ends with a recap.

What you will be able to do

• Tell whether a tool counts as an AI system under the Act
• Explain when the Act applies to companies outside the EU
• Start an AI inventory listing each tool, its use and its source

Why it matters

Many learners in Dubai, India and the Philippines serve EU clients; knowing that the Act follows the AI tells you when it reaches your work.

Practice: Practice: What counts as AI, and who is covered · 3 questions

Opens with a product meeting at JKL Recruit, where someone proposes a mood score: AI that watches candidates' video interviews and rates how confident, nervous or enthusiastic they seem. Explains Article 5, which bans a short list of practices for providers and users since 2 February 2025, with the Act's highest fines. Shows what the bans protect, such as privacy, so that faces are not harvested in bulk and feelings at work stay private. Covers the ban on inferring emotions at work, including for job candidates, except for medical or safety reasons, and the two practices banned from 2 December 2026: non-consensual intimate deepfakes and child sexual abuse material, with an example from an office in Brussels. Ends with four things to do if you meet a prohibited practice, including speaking up through compliance or legal, and a recap.

What you will be able to do

• Recognise the AI practices banned under Article 5
• Explain why emotion inference at work, including for candidates, is banned
• Report a prohibited practice through your compliance or legal team

Why it matters

Prohibited practices carry the Act's highest fines, so spotting one at the idea stage saves a product, a contract and a penalty.

Practice: Practice: Prohibited AI practices · 3 questions

Starts with a sales call in which a bank in Frankfurt asks whether JKL Recruit's CV ranking is high-risk, and the salesperson says no because a human always makes the final decision. Explains the two routes to high-risk AI: regulated products in Annex I and the use cases listed in Annex III. Covers the eight listed areas, including employment, credit, education and essential services, with employment examples and a university in Madrid. Explains the narrow exception, which never applies to profiling and must be documented and registered by a provider relying on it. Then sets out the dates as amended: 2 December 2027 for listed uses and 2 August 2028 for products, and why JKL has started preparing now. Ends with three things to remember and a recap.

What you will be able to do

• Explain the two routes by which AI becomes high-risk
• Identify uses in employment that the Act lists as high-risk
• State when the high-risk rules apply, as amended in 2026

Why it matters

Helping a human decide can still be high-risk; answering a client's question correctly protects both the sale and your company.

Practice: Practice: High-risk AI · 3 questions

Opens with a hospital in Amsterdam about to use JKL Recruit's platform to recruit nurses, whose HR director assumes the compliance is all the builder's. Explains the requirements for high-risk AI: risk management, data, documentation, logs, transparency, human oversight, accuracy and security. Shows the provider's path to market: a quality system, conformity assessment, the EU declaration of conformity, CE marking, registration in the EU database and monitoring after launch. Covers the deployer's duties to use the system as instructed, assign human oversight, keep logs and inform people, the fundamental rights assessment some deployers must make first, and people's right to an explanation, with underwriters at an insurer in Milan as a second deployer. Ends with three habits and a recap.

What you will be able to do

• List the requirements a high-risk AI system must meet
• Separate the provider's duties from the deployer's duties
• Explain when people have a right to an explanation

Why it matters

Both the builder and the user have duties, so knowing which ones are yours prevents gaps that neither side covers.

Practice: Practice: Duties of providers and deployers · 3 questions

Starts on the careers platform JKL Recruit runs for its clients, where a candidate chats for ten minutes with Sophie before asking whether she is a real person and learning she is a chatbot. Explains the four transparency duties: telling people they are interacting with AI unless it is obvious, machine-readable marking of AI content by providers, deployers disclosing deepfakes, and informing people exposed to emotion recognition or biometric categorisation. Covers disclosure of AI text published to inform the public on matters of public interest under Article 50, unless a person reviews it and holds editorial responsibility, and asking your legal team before using a real person's face or voice. Shows the timeline, with duties from 2 August 2026 and until 2 December 2026 for marking by older systems. Ends with four habits and a recap.

What you will be able to do

• Explain when people must be told they are dealing with AI
• Describe the duties to mark AI content and label deepfakes
• State when the transparency duties apply

Why it matters

If AI could mislead people, saying so keeps trust with candidates and customers and keeps your company within the rules.

Practice: Practice: Transparency: chatbots, deepfakes and AI content · 3 questions

Opens with a question from JKL's head of product: its job-advert writer runs on another company's large language model, so whose rules apply? Explains the definition of a general-purpose AI model and the duties every provider has: technical documentation, information for downstream builders, a copyright policy, and a training content summary using a template from the AI Office. Covers open-source exemptions, the extra duties for models with systemic risk, and the voluntary code of practice as a way to show compliance. Shows a software company in Mumbai building a contract review tool on another company's model, questions to add to your tool selection checklist, and the dates, with model rules applying since 2 August 2025. Ends with four habits and a recap.

What you will be able to do

• Describe the duties of providers of general-purpose AI models
• Explain the extra duties for models with systemic risk
• Separate the model's duties from those of the system built on it

Why it matters

A good model does not make every use compliant; knowing the layers shows which duties stay with your own product.

Practice: Practice: General-purpose AI models · 3 questions

Starts with a software partner in Madrid that wants to resell JKL's candidate-ranking tool under its own name and logo, which changes who the provider is. Explains that duties follow roles: putting your name on a high-risk system, modifying it substantially or changing its purpose can make you its provider, and distributors and importers must not supply a system they believe does not conform. Covers AI literacy as the skills, knowledge and understanding that let people make informed use of AI, suited to each person's role and context. Then shows human oversight in practice: a recruiter at JKL's client in Dubai, short of time, and staff at a bank in Dublin reviewing loan decisions suggested by AI. Ends with a reseller checklist, a common mistake and a recap.

What you will be able to do

• Explain how a reseller or modifier can become a provider
• Describe the AI literacy measures suited to your role
• Apply human oversight by questioning, overriding or stopping AI output

Why it matters

Your role decides your duties, and real oversight means you can explain and challenge what the AI suggests before acting on it.

Practice: Practice: Roles, AI literacy and human oversight · 3 questions

Opens in JKL's boardroom in Paris, where the finance director asks when the company must be ready, what happens if it is not, who would check, and whether one candidate's complaint could start an investigation. Puts the dates in order: the prohibitions, AI literacy, general-purpose model rules and transparency duties that already apply, the high-risk dates in December 2027 and August 2028, and 2 August 2030 for high-risk AI used by public authorities. Explains how national market surveillance authorities enforce most of the Act, each country's single point of contact, and how the AI Office within the European Commission supervises general-purpose AI models. Covers fines of up to 35 million euros or 7% of turnover for prohibited practices, with lower caps for smaller companies. Ends with a common mistake about the dates and a recap.

What you will be able to do

• Put the Act's application dates in order
• Explain who enforces the Act nationally and at EU level
• Describe the penalty levels and the caps for smaller companies

Why it matters

Only some dates moved and much of the Act applies today, so a clear timeline stops your organisation from waiting too long.

Practice: Practice: Dates, authorities and penalties · 3 questions

Starts with JKL's compliance lead, who has five checklists kept by three teams, covering the ranking tool, the chatbot, the advert writer, AI literacy and prohibited practices, with nobody owning the whole. Explains ISO/IEC 42001, first published in December 2023, as one voluntary, certifiable management system for AI, with risk and impact assessment and nine control objectives in Annex A, which organises the work but does not replace the Act. Follows JKL's candidate-ranking tool through every module of the course, then shows an agent at a support centre in Manila answering customers in Europe. Sets out your habits: approved tools, no prohibited uses, openness, questioning output and reporting concerns. Ends with a recap and the final exam: thirty scenario questions, with 60% needed for the Certificate of Completion.

What you will be able to do

• Explain how ISO/IEC 42001 can organise AI Act duties
• Apply five daily habits when using AI at work
• Describe how the final exam and certificate work

Why it matters

One management system replaces scattered checklists, and your own daily habits are where the Act's rules become practice.

Practice: Practice: ISO/IEC 42001, your role, and the exam · 3 questions